Password Strength Checker

Composition rules measure the wrong thing

The familiar meter that turns green once you add a capital, a digit and a symbol is measuring compliance with a rule, not resistance to cracking. "P@ssw0rd1" satisfies every such rule and is among the first candidates any cracking tool tries, because the substitutions are entirely predictable. Meanwhile a long passphrase of ordinary lowercase words fails those rules and is vastly stronger.

What strength actually means

Entropy measures how many guesses an attacker would need. Each additional character multiplies the search space, while adding a character class only widens the base, so length dominates. A 20-character lowercase password has more entropy than a 10-character password using every class. This is why current NIST guidance recommends allowing long passwords and dropping mandatory composition rules, which mainly push people toward predictable patterns.

Pattern detection is what a good checker does

Realistic assessment estimates how a cracking tool would attack the password, not how many theoretical combinations exist. Dictionary words, names, dates, keyboard runs such as qwerty, repeated characters, leetspeak substitutions and appended years all shrink the real search space dramatically. A password scoring well on naive entropy can fall in seconds if it is a known word with predictable decoration.

Breach exposure matters more than complexity

If a password appears in a breach corpus, its complexity is irrelevant: it is already in the wordlists attackers run first. Checking against known-breached passwords, using a service that queries by partial hash so the password itself is never transmitted, is a more useful test than any strength meter. A complex password that has leaked is worse than a simple one that has not.

Reuse is the actual failure mode

Most account compromises are not cracked passwords, they are credential stuffing: a password leaked from one site tried everywhere else. A unique password per site, stored in a password manager, prevents this entirely and matters more than the strength of any individual password. Add multi-factor authentication where offered, which defeats stuffing even when the password is known.

Checked locally

Analysis runs in your browser and nothing is transmitted. Never type a real password into a tool that sends it to a server.